From mboxrd@z Thu Jan 1 00:00:00 1970 From: Cong Wang Subject: [Patch net-next] net_sched: properly check for empty skb array on error path Date: Mon, 18 Dec 2017 14:34:26 -0800 Message-ID: <20171218223426.4685-1-xiyou.wangcong@gmail.com> Cc: Cong Wang , John Fastabend To: netdev@vger.kernel.org Return-path: Received: from mail-pg0-f66.google.com ([74.125.83.66]:35845 "EHLO mail-pg0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1759065AbdLRWed (ORCPT ); Mon, 18 Dec 2017 17:34:33 -0500 Received: by mail-pg0-f66.google.com with SMTP id k134so9737416pga.3 for ; Mon, 18 Dec 2017 14:34:33 -0800 (PST) Sender: netdev-owner@vger.kernel.org List-ID: First, the check of &q->ring.queue against NULL is wrong, it is always false. We should check the value rather than the address. Secondly, we need the same check in pfifo_fast_reset() too, as both ->reset() and ->destroy() are called in qdisc_destroy(). Fixes: c5ad119fb6c0 ("net: sched: pfifo_fast use skb_array") Reported-by: syzbot Cc: John Fastabend Signed-off-by: Cong Wang --- net/sched/sch_generic.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c index 981c08fe810b..876fab2604b8 100644 --- a/net/sched/sch_generic.c +++ b/net/sched/sch_generic.c @@ -659,6 +659,12 @@ static void pfifo_fast_reset(struct Qdisc *qdisc) struct skb_array *q = band2list(priv, band); struct sk_buff *skb; + /* NULL ring is possible if destroy path is due to a failed + * skb_array_init() in pfifo_fast_init() case. + */ + if (!q->ring.queue) + continue; + while ((skb = skb_array_consume_bh(q)) != NULL) kfree_skb(skb); } @@ -719,7 +725,7 @@ static void pfifo_fast_destroy(struct Qdisc *sch) /* NULL ring is possible if destroy path is due to a failed * skb_array_init() in pfifo_fast_init() case. */ - if (!&q->ring.queue) + if (!q->ring.queue) continue; /* Destroy ring but no need to kfree_skb because a call to * pfifo_fast_reset() has already done that work. -- 2.13.0